@skip-ai/scanner 0.5.0 → 0.7.0

package/dist/index.js

@@ -2,11 +2,9 @@
 import fs from 'fs';
 import path from 'path';
 import chalk from 'chalk';
-import { parseCli } from './cli.js';
-import { maskObject } from './scanner/secrets.js';
-import { uploadReport, pollStatus } from './uploader.js';
-import { banner, spinner, printSummary, fail } from './ui.js';
-// Modo legado de extração
+import { parseCli, maskToken } from './cli.js';
+import { uploadArtifactBundle } from './uploader.js';
+import { banner, spinner, fail } from './ui.js';
 import { detectProject } from './detector.js';
 import { extractRoutes } from './scanner/routes.js';
 import { extractComponents } from './scanner/components.js';
@@ -16,7 +14,20 @@ import { buildBriefing } from './scanner/briefing.js';
 import { buildWidgetSnippet } from './scanner/widget-snippet.js';
 import { auditWcag, summarize, WCAG_RULES_VERSION } from './scanner/wcag.js';
 import { calculateScore, scoreColor } from './scanner/score.js';
-/** Aplica cor do chalk conforme o score (necessário porque chalk não é indexável por string). */
+import { detectGuidedFlows } from './scanner/guided-flows.js';
+import { appendHistory } from './scanner/history.js';
+import { buildReport, maskReportSecrets, CLI_VERSION } from './reporter.js';
+import { DEFAULT_IGNORE_PATTERNS } from './scanner/ignore.js';
+import { buildScanArtifact, detectArtifactType, loadJsonFile, validateFileManifestArtifact, validateReportArtifact, validateUploadManifestArtifact, validateValidationArtifact, validateWcagAuditArtifact, } from './artifacts.js';
+import { buildSemanticApplicationMap, createFileManifest, normalizeSemanticApplicationMap, validateSamArtifact, writeSkipSamFile, } from './sam.js';
+const REQUIRED_ARTIFACTS = [
+    '.skip-report.json',
+    '.skip-sam.json',
+    '.skip-wcag-audit.json',
+    'scan-file-manifest.json',
+    'upload-manifest.json',
+    'scan-validation.json',
+];
 function colorScore(score) {
     const c = scoreColor(score);
     if (c === 'green')
@@ -27,113 +38,267 @@ function colorScore(score) {
         return chalk.bold.magenta(`${score}/100`);
     return chalk.bold.red(`${score}/100`);
 }
-import { detectGuidedFlows } from './scanner/guided-flows.js';
-import { appendHistory } from './scanner/history.js';
-import { buildReport, maskReportSecrets, CLI_VERSION } from './reporter.js';
-import { DEFAULT_IGNORE_PATTERNS } from './scanner/ignore.js';
-import { maskToken } from './cli.js';
-// ============ MODO SEND (transportador puro) ============
+function createScanId() {
+    return `scan_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+function writeJson(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(value, null, 2));
+}
+function appendLog(outputDir, message) {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.appendFileSync(path.join(outputDir, 'scanner.log'), `${new Date().toISOString()} ${message}\n`);
+}
+function safeRelative(from, to) {
+    return path.relative(from, to).replace(/\\/g, '/') || '.';
+}
+function discoverApplicationRoots(workspaceRoot) {
+    const candidates = ['.', 'apps/*', 'packages/*'];
+    const roots = new Set();
+    for (const pattern of candidates) {
+        const base = pattern.endsWith('/*') ? pattern.slice(0, -2) : pattern;
+        const absBase = path.join(workspaceRoot, base);
+        if (!fs.existsSync(absBase))
+            continue;
+        if (pattern === '.') {
+            if (fs.existsSync(path.join(workspaceRoot, 'package.json')))
+                roots.add(workspaceRoot);
+            continue;
+        }
+        for (const name of fs.readdirSync(absBase)) {
+            const dir = path.join(absBase, name);
+            if (fs.statSync(dir).isDirectory() && fs.existsSync(path.join(dir, 'package.json')))
+                roots.add(dir);
+        }
+    }
+    return [...roots];
+}
+function selectApplicationRoot(workspaceRoot, app) {
+    if (app)
+        return path.resolve(workspaceRoot, app);
+    const roots = discoverApplicationRoots(workspaceRoot);
+    const frontend = roots.find((root) => {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf-8'));
+            const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+            return Boolean(deps.next || deps.vite || deps.react || deps.vue || deps['react-router-dom']);
+        }
+        catch {
+            return false;
+        }
+    });
+    return frontend ?? workspaceRoot;
+}
+function validateArtifactByType(filePath, type, context) {
+    const payload = loadJsonFile(filePath);
+    if (type === 'semantic-map')
+        return validateSamArtifact(payload, context);
+    if (type === 'report')
+        return validateReportArtifact(payload);
+    if (type === 'wcag-audit')
+        return validateWcagAuditArtifact(payload);
+    if (type === 'file-manifest')
+        return validateFileManifestArtifact(payload);
+    if (type === 'upload-manifest')
+        return validateUploadManifestArtifact(payload);
+    if (type === 'validation')
+        return validateValidationArtifact(payload);
+    return { valid: true, errors: [], warnings: [], artifactType: type };
+}
 async function sendMode(opts) {
+    if (opts.dir) {
+        const dir = path.resolve(opts.dir);
+        const missing = REQUIRED_ARTIFACTS.filter((file) => !fs.existsSync(path.join(dir, file)));
+        if (missing.length)
+            throw new Error(`Upload parcial bloqueado. Artefatos ausentes em ${dir}:\n${missing.join('\n')}`);
+        opts.file = REQUIRED_ARTIFACTS.map((file) => path.join(dir, file));
+    }
     console.log(banner(CLI_VERSION));
-    console.log(chalk.dim(`   Modo: send (transportador)`));
+    console.log(chalk.dim('   Modo: send (artefatos)'));
     console.log(chalk.dim(`   Plataforma: ${opts.url}`));
     console.log(chalk.dim(`   Token: ${maskToken(opts.token)}`));
-    console.log(chalk.dim(`   Arquivo: ${opts.file}\n`));
-    // 1. Ler o payload do arquivo
-    if (!fs.existsSync(opts.file)) {
-        throw new Error(`Arquivo não encontrado: ${opts.file}`);
-    }
-    const readSpinner = spinner('Lendo payload...');
-    let payload;
-    try {
-        payload = JSON.parse(fs.readFileSync(opts.file, 'utf-8'));
-    }
-    catch (e) {
-        readSpinner.fail();
-        throw new Error(`JSON inválido em ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    readSpinner.succeed('Payload carregado.');
-    // 2. Checagem mínima de estrutura — bloqueia se não há dados de scan
-    if (!payload.navigationMap && !payload.routes && !payload.wcag) {
-        throw new Error('O payload não contém navigationMap, routes nem wcag. Use o validador da skill antes de enviar: node validate-report.js <arquivo>');
-    }
-    // Aviso (não bloqueia) se faltar auditoria WCAG — o scan estará incompleto
-    if (!payload.wcag) {
-        console.log(chalk.yellow('   ⚠ Payload sem bloco wcag — o scan estará incompleto no dashboard.'));
-    }
-    // 3. Preencher metadados se faltarem
-    if (!payload.metadata) {
-        payload.metadata = {
-            framework: payload.framework ?? 'unknown',
-            language: payload.language ?? 'TypeScript',
-            packageCount: 0,
-            typescript: payload.language === 'TypeScript',
-            scannedAt: new Date().toISOString(),
-            cliVersion: CLI_VERSION,
-        };
-    }
-    // 4. Mascara secrets
-    const { result: masked, count: secretsFound } = maskObject(payload);
-    const report = { ...masked, secretsFound };
-    if (secretsFound > 0) {
-        console.log(chalk.yellow(`⚠ ${secretsFound} possível(eis) secret(s) mascarado(s) antes do envio.`));
-    }
-    if (opts.verbose) {
-        console.log('\n' + chalk.dim('Payload a enviar:'));
-        console.log(chalk.dim(JSON.stringify(report, null, 2).slice(0, 2000) + (JSON.stringify(report).length > 2000 ? '...' : '')));
-    }
-    // 5. Enviar
-    const uploadSpinner = spinner('Enviando para o Skip Cloud...');
-    const scanId = await uploadReport(report, opts.token, opts.url);
-    uploadSpinner.succeed(`Scan enviado! ID: ${chalk.yellow(scanId)}`);
-    // 6. Polling (opcional)
-    if (opts.noPolling) {
-        console.log(chalk.dim('\n--no-polling: não aguardando enriquecimento.\n'));
-        return;
+    console.log(chalk.dim(`   Arquivos: ${opts.file.join(', ')}\n`));
+    const artifacts = [];
+    let expectedScanId = opts.scanId;
+    for (const file of opts.file) {
+        if (!fs.existsSync(file))
+            throw new Error(`Arquivo não encontrado: ${file}`);
+        let payload;
+        try {
+            payload = loadJsonFile(file);
+        }
+        catch (e) {
+            throw new Error(`JSON inválido em ${file}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        const detected = opts.type ?? detectArtifactType(file, payload);
+        if (detected === 'semantic-map') {
+            const result = validateSamArtifact(payload, {
+                currentScanId: expectedScanId,
+                expectedFilename: '.skip-sam.json',
+            });
+            if (!result.valid)
+                throw new Error(result.errors.join('\n'));
+            expectedScanId = String(payload.scanId ?? expectedScanId ?? '');
+        }
+        else {
+            const result = validateArtifactByType(file, detected, {});
+            if (!result.valid)
+                throw new Error(result.errors.join('\n'));
+        }
+        const scanId = String(payload.scanId ?? expectedScanId ?? createScanId());
+        artifacts.push(buildScanArtifact(path.dirname(path.resolve(file)), path.basename(file), detected, scanId));
     }
-    const status = await pollStatus(scanId, opts.token, opts.url);
-    printSummary({ scanId, entitiesCount: status.entitiesCount, baseUrl: opts.url, status: status.status });
-    if (status.status !== 'COMPLETED')
-        process.exitCode = 1;
+    const manifest = {
+        schemaVersion: '1.0.0',
+        artifactType: 'upload-manifest',
+        scanId: expectedScanId ?? artifacts[0].scanId,
+        expectedFileCount: artifacts.length,
+        files: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+        artifacts: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+    };
+    console.log(`Artefatos preparados: ${artifacts.length}`);
+    for (const artifact of artifacts)
+        console.log(`✓ ${artifact.filename}`);
+    const uploadSpinner = spinner('Enviando artefatos para o Skip Cloud...');
+    const result = await uploadArtifactBundle(artifacts, opts.token, opts.url, manifest);
+    uploadSpinner.succeed(`Artefatos enviados e confirmados. Scan ID: ${chalk.yellow(result.scanId)}`);
 }
-// ============ MODO SCAN (legado, extração por regex) ============
 async function scanMode(opts) {
     console.log(banner(CLI_VERSION));
-    console.log(chalk.dim(`   Modo: scan (legado, regex)`));
-    const rootDir = path.resolve(opts.dir);
-    console.log(chalk.dim(`   Diretório: ${rootDir}`));
-    console.log(chalk.dim(`   Plataforma: ${opts.url}\n`));
-    console.log(chalk.yellow('   ⚠ Modo scan usa extração por regex (menos inteligente que o agente).\n'));
+    const workspaceRoot = path.resolve(opts.dir);
+    const applicationRoot = selectApplicationRoot(workspaceRoot, opts.app);
+    const scanId = createScanId();
+    const outputDir = path.resolve(opts.outputDir ?? path.join(workspaceRoot, '.skip-output', scanId));
+    const startedAt = new Date().toISOString();
     const ignorePatterns = [...DEFAULT_IGNORE_PATTERNS, ...opts.ignore];
-    const detectSpinner = spinner('Detectando projeto...');
-    const signature = detectProject(rootDir);
-    detectSpinner.succeed(`Framework detectado: ${chalk.cyan(signature.framework)} (${signature.language})`);
-    const routeSpinner = spinner('Extraindo rotas...');
-    const routes = await extractRoutes(rootDir, signature.srcDir, ignorePatterns);
-    routeSpinner.succeed(`${routes.length} rotas encontradas`);
-    const compSpinner = spinner('Extraindo componentes e eventos...');
-    const { components, events } = await extractComponents(rootDir, opts.ignore);
-    compSpinner.succeed(`${components.length} componentes, ${events.length} eventos`);
-    const apiSpinner = spinner('Extraindo chamadas de API...');
-    const apiCalls = await extractApiCalls(rootDir, opts.ignore);
-    apiSpinner.succeed(`${apiCalls.length} chamadas de API detectadas`);
-    const navSpinner = spinner('Construindo mapa de navegação...');
-    const navigationMap = await extractNavigation(rootDir, opts.ignore, {
+    console.log(chalk.dim('   Modo: scan'));
+    console.log(chalk.dim(`   Diretorio: ${workspaceRoot}`));
+    console.log(chalk.dim(`   Aplicacao: ${applicationRoot}`));
+    console.log(chalk.dim(`   Output: ${outputDir}`));
+    console.log(chalk.dim(`   Plataforma: ${opts.url}`));
+    console.log(chalk.dim(`   Scan ID: ${scanId}\n`));
+    console.log('[1/10] Detectando projeto');
+    fs.mkdirSync(outputDir, { recursive: true });
+    appendLog(outputDir, `[SAM] Scanner version: ${CLI_VERSION}`);
+    appendLog(outputDir, `[SAM] Project root: ${workspaceRoot}`);
+    appendLog(outputDir, `[SAM] Workspace root: ${workspaceRoot}`);
+    appendLog(outputDir, `[SAM] Application roots: ${discoverApplicationRoots(workspaceRoot).map((root) => safeRelative(workspaceRoot, root)).join(', ')}`);
+    const signature = detectProject(applicationRoot);
+    const projectName = path.basename(applicationRoot);
+    console.log('[2/10] Descobrindo arquivos');
+    const fileManifest = await createFileManifest(applicationRoot, ignorePatterns);
+    appendLog(outputDir, `[SAM] Files discovered: ${fileManifest.files.length}`);
+    appendLog(outputDir, `[SAM] Source files included: ${fileManifest.files.filter((file) => /\.(tsx?|jsx?|html|vue|svelte|astro)$/.test(file.path)).length}`);
+    const fileManifestPayload = { schemaVersion: '1.0.0', artifactType: 'file-manifest', scanId, files: fileManifest.files, sha256: fileManifest.sha256 };
+    writeJson(path.join(outputDir, 'scan-file-manifest.json'), fileManifestPayload);
+    console.log('[3/10] Detectando rotas e telas');
+    const routes = await extractRoutes(applicationRoot, signature.srcDir, ignorePatterns);
+    appendLog(outputDir, `[SAM] Route files: ${routes.map((route) => route.physicalPath).join(', ')}`);
+    appendLog(outputDir, `[SAM] Routes detected: ${routes.length}`);
+    const navigationMap = await extractNavigation(applicationRoot, opts.ignore, {
         pagesRoutes: routes.map((r) => ({ physicalPath: r.physicalPath, logicalRoute: r.logicalRoute })),
         srcDir: signature.srcDir,
     });
-    const totalActions = navigationMap.screens.reduce((acc, s) => acc + s.actions.length, 0);
-    navSpinner.succeed(`${navigationMap.screens.length} telas mapeadas, ${totalActions} ações, ${navigationMap.navigationGraph.length} arestas de navegação`);
+    appendLog(outputDir, `[SAM] Screens detected: ${navigationMap.screens.length}`);
+    console.log('[4/10] Analisando componentes');
+    const { components, events } = await extractComponents(applicationRoot, opts.ignore);
+    const apiCalls = await extractApiCalls(applicationRoot, opts.ignore);
+    appendLog(outputDir, `[SAM] Components detected: ${components.length}`);
+    appendLog(outputDir, `[SAM] Interactive elements detected: ${navigationMap.screens.reduce((acc, screen) => acc + screen.actions.length, 0)}`);
+    appendLog(outputDir, `[SAM] Candidate entities: ${routes.length + navigationMap.screens.length + components.length + apiCalls.length}`);
     const briefing = buildBriefing(navigationMap);
     const widgetSnippet = buildWidgetSnippet();
-    // ---- Auditoria WCAG ----
-    // Lê os arquivos das telas LOCALMENTE (não envia o conteúdo ao servidor).
-    const auditSpinner = spinner('Auditando WCAG...');
+    const guidedFlows = detectGuidedFlows(navigationMap);
+    console.log('[5/10] Gerando `.skip-sam.json`');
+    let sam = buildSemanticApplicationMap({
+        scanId,
+        startedAt,
+        rootDir: applicationRoot,
+        workspaceRoot,
+        applicationRoot,
+        signature,
+        routes,
+        components,
+        apiCalls,
+        navigationMap,
+        guidedFlows,
+        fileManifest: fileManifest.files,
+        sourceManifestSha256: fileManifest.sha256,
+        projectName,
+    });
+    sam = normalizeSemanticApplicationMap(sam);
+    appendLog(outputDir, `[SAM] Normalized entities: ${sam.entities.length}`);
+    appendLog(outputDir, `[SAM] Discarded entities: 0`);
+    appendLog(outputDir, `[SAM] Generated IDs: ${sam.entities.filter((entity) => entity.id).length}`);
+    appendLog(outputDir, `[SAM] Entities sent to validator: ${sam.entities.length}`);
+    appendLog(outputDir, `[SAM] Relationships sent to validator: ${sam.relationships.length}`);
+    writeJson(path.join(outputDir, '.skip-sam.invalid.json'), sam);
+    const validatorInputSummary = {
+        keys: Object.keys(sam),
+        artifactType: sam.artifactType,
+        scanId: sam.scanId,
+        entitiesType: Array.isArray(sam.entities) ? 'array' : typeof sam.entities,
+        entitiesCount: sam.entities.length,
+        relationshipsType: Array.isArray(sam.relationships) ? 'array' : typeof sam.relationships,
+        relationshipsCount: sam.relationships.length,
+    };
+    appendLog(outputDir, `[SAM] Validator input: ${JSON.stringify(validatorInputSummary)}`);
+    console.log('[6/10] Validando `.skip-sam.json`');
+    const samValidation = validateSamArtifact(sam, {
+        currentScanId: scanId,
+        scanStartedAt: startedAt,
+        fileManifest: fileManifest.files,
+        sourceManifestSha256: fileManifest.sha256,
+        expectedFilename: '.skip-sam.json',
+    });
+    sam.validation = { valid: samValidation.valid, errors: samValidation.errors, warnings: samValidation.warnings };
+    if (!samValidation.valid) {
+        sam.status = sam.status === 'complete' ? 'partial' : sam.status;
+        writeJson(path.join(outputDir, 'scanner-diagnostics.json'), {
+            schemaVersion: '1.0.0',
+            artifactType: 'diagnostics',
+            scanId,
+            scannerVersion: CLI_VERSION,
+            projectRoot: workspaceRoot,
+            workspaceRoot,
+            applicationRoots: discoverApplicationRoots(workspaceRoot).map((root) => safeRelative(workspaceRoot, root)),
+            applicationRoot,
+            filesDiscovered: fileManifest.files.length,
+            sourceFilesIncluded: fileManifest.files.filter((file) => /\.(tsx?|jsx?|html|vue|svelte|astro)$/.test(file.path)).length,
+            routeFilesDetected: routes.map((route) => route.physicalPath),
+            routesDetected: routes.length,
+            screensDetected: navigationMap.screens.length,
+            componentsDetected: components.length,
+            interactiveElementsDetected: navigationMap.screens.reduce((acc, screen) => acc + screen.actions.length, 0),
+            apisDetected: apiCalls.length,
+            flowsDetected: guidedFlows.length,
+            candidateEntities: routes.length + navigationMap.screens.length + components.length + apiCalls.length,
+            normalizedEntities: sam.entities.length,
+            discardedEntities: 0,
+            generatedEntityIds: sam.entities.filter((entity) => entity.id).length,
+            entitiesSentToValidator: sam.entities.length,
+            relationshipsSentToValidator: sam.relationships.length,
+            validatorInputSummary,
+            validationErrors: samValidation.errors,
+        });
+        writeJson(path.join(outputDir, 'scan-validation.json'), {
+            schemaVersion: '1.0.0',
+            artifactType: 'validation',
+            scanId,
+            valid: false,
+            generatedAt: new Date().toISOString(),
+            errors: samValidation.errors,
+        });
+        if (opts.validateSam)
+            throw new Error(`Falha ao validar .skip-sam.json:\n${samValidation.errors.join('\n')}`);
+    }
+    const samPath = writeSkipSamFile(outputDir, sam);
+    fs.rmSync(path.join(outputDir, '.skip-sam.invalid.json'), { force: true });
+    console.log('[7/10] Gerando auditoria WCAG');
     const contentsByFile = {};
     for (const s of navigationMap.screens) {
-        const abs = path.join(rootDir, s.filePath);
         try {
-            contentsByFile[s.filePath] = fs.readFileSync(abs, 'utf-8');
+            contentsByFile[s.filePath] = fs.readFileSync(path.join(applicationRoot, s.filePath), 'utf-8');
         }
         catch {
             contentsByFile[s.filePath] = '';
@@ -151,10 +316,6 @@ async function scanMode(opts) {
         auditedAt: new Date().toISOString(),
         rulesVersion: WCAG_RULES_VERSION,
     };
-    auditSpinner.succeed(`WCAG: score ${colorScore(score)} (${level}), ${total} violação(ões) únicas, ${checks.total} checks [${summary.critical}c/${summary.serious}s/${summary.moderate}m/${summary.minor}i/${summary.unknown}u]`);
-    // ---- Fluxos guiados ----
-    const guidedFlows = detectGuidedFlows(navigationMap);
-    // ---- Histórico (local, enviado junto pra o dashboard) ----
     const historyEntry = {
         scannedAt: wcag.auditedAt,
         score,
@@ -165,59 +326,194 @@ async function scanMode(opts) {
         minor: summary.minor,
         unknown: summary.unknown,
     };
-    const history = appendHistory(rootDir, historyEntry);
+    const history = appendHistory(applicationRoot, historyEntry);
     const uniqueFiles = new Set([
         ...routes.map((r) => r.physicalPath),
         ...components.map((c) => c.filepath),
         ...apiCalls.map((a) => a.filepath),
         ...navigationMap.screens.map((s) => s.filePath),
     ]);
-    const projectName = path.basename(rootDir);
     const rawReport = buildReport({
-        signature, routes, components, events, apiCalls,
-        navigationMap, widgetSnippet, briefing, wcag, guidedFlows, history,
-        filesScanned: uniqueFiles.size, projectName,
+        signature,
+        routes,
+        components,
+        events,
+        apiCalls,
+        navigationMap,
+        widgetSnippet,
+        briefing,
+        wcag,
+        guidedFlows,
+        history,
+        filesScanned: uniqueFiles.size,
+        projectName,
     });
+    rawReport.scanId = scanId;
+    rawReport.semanticMapSummary = {
+        status: sam.status,
+        entities: sam.entities.length,
+        relationships: sam.relationships.length,
+        routes: sam.stats.routes,
+        components: sam.stats.components,
+        coverage: sam.coverage.percentage,
+    };
+    rawReport.artifactType = 'report';
+    rawReport.schemaVersion = '1.0.0';
+    rawReport.generatedAt = new Date().toISOString();
+    rawReport.framework = signature.framework;
+    rawReport.language = signature.language;
+    rawReport.wcagSummary = summary;
+    const wcagPayload = {
+        schemaVersion: '1.0.0',
+        artifactType: 'wcag-audit',
+        scanId,
+        generatedAt: wcag.auditedAt,
+        status: 'complete',
+        findings: violations,
+        checks: { total: checks.total, passed: checks.passed, failed: checks.failed, incomplete: checks.needsReview, inapplicable: 0, needsReview: checks.needsReview },
+        summary,
+        violations,
+        score,
+        level,
+        rulesVersion: WCAG_RULES_VERSION,
+    };
+    writeJson(path.join(outputDir, '.skip-wcag-audit.json'), wcagPayload);
+    const samArtifact = buildScanArtifact(outputDir, '.skip-sam.json', 'semantic-map', scanId);
+    rawReport.relatedArtifacts = [
+        {
+            artifactType: 'semantic-map',
+            filename: '.skip-sam.json',
+            path: path.relative(outputDir, samPath) || '.skip-sam.json',
+            required: true,
+            scanId,
+            sizeBytes: samArtifact.sizeBytes,
+            sha256: samArtifact.sha256,
+        },
+    ];
     const { report, secretsFound } = maskReportSecrets(rawReport);
-    if (secretsFound > 0) {
-        console.log(chalk.yellow(`⚠ ${secretsFound} possível(eis) secret(s) mascarado(s) antes do envio.`));
+    if (secretsFound > 0)
+        console.log(chalk.yellow(`${secretsFound} possível(eis) secret(s) mascarado(s) antes do envio.`));
+    writeJson(path.join(outputDir, '.skip-report.json'), report);
+    writeJson(path.join(outputDir, 'scanner-diagnostics.json'), {
+        schemaVersion: '1.0.0',
+        artifactType: 'diagnostics',
+        scanId,
+        scannerVersion: CLI_VERSION,
+        projectRoot: workspaceRoot,
+        workspaceRoot,
+        applicationRoots: discoverApplicationRoots(workspaceRoot).map((root) => safeRelative(workspaceRoot, root)),
+        applicationRoot,
+        filesDiscovered: fileManifest.files.length,
+        sourceFilesIncluded: fileManifest.files.filter((file) => /\.(tsx?|jsx?|html|vue|svelte|astro)$/.test(file.path)).length,
+        routeFilesDetected: routes.map((route) => route.physicalPath),
+        routesDetected: routes.length,
+        screensDetected: navigationMap.screens.length,
+        componentsDetected: components.length,
+        interactiveElementsDetected: navigationMap.screens.reduce((acc, screen) => acc + screen.actions.length, 0),
+        apisDetected: apiCalls.length,
+        flowsDetected: guidedFlows.length,
+        candidateEntities: routes.length + navigationMap.screens.length + components.length + apiCalls.length,
+        normalizedEntities: sam.entities.length,
+        discardedEntities: 0,
+        generatedEntityIds: sam.entities.filter((entity) => entity.id).length,
+        entitiesSentToValidator: sam.entities.length,
+        relationshipsSentToValidator: sam.relationships.length,
+        validatorInputSummary,
+    });
+    console.log('[8/10] Validando artefatos');
+    const firstArtifacts = [
+        buildScanArtifact(outputDir, '.skip-report.json', 'report', scanId),
+        samArtifact,
+        buildScanArtifact(outputDir, '.skip-wcag-audit.json', 'wcag-audit', scanId),
+        buildScanArtifact(outputDir, 'scan-file-manifest.json', 'file-manifest', scanId),
+    ];
+    const validationPayload = {
+        schemaVersion: '1.0.0',
+        artifactType: 'validation',
+        scanId,
+        valid: true,
+        generatedAt: new Date().toISOString(),
+        artifacts: firstArtifacts.map((artifact) => ({
+            filename: artifact.filename,
+            artifactType: artifact.artifactType,
+            valid: true,
+            sha256: artifact.sha256,
+        })),
+    };
+    writeJson(path.join(outputDir, 'scan-validation.json'), validationPayload);
+    const validationArtifact = buildScanArtifact(outputDir, 'scan-validation.json', 'validation', scanId);
+    const provisionalArtifacts = [...firstArtifacts, validationArtifact];
+    const uploadManifestPayload = {
+        schemaVersion: '1.0.0',
+        artifactType: 'upload-manifest',
+        scanId,
+        createdAt: new Date().toISOString(),
+        expectedFileCount: REQUIRED_ARTIFACTS.length,
+        files: provisionalArtifacts.map(({ absolutePath, ...artifact }) => artifact),
+        artifacts: provisionalArtifacts.map(({ absolutePath, ...artifact }) => artifact),
+    };
+    writeJson(path.join(outputDir, 'upload-manifest.json'), uploadManifestPayload);
+    let uploadArtifact = buildScanArtifact(outputDir, 'upload-manifest.json', 'upload-manifest', scanId);
+    let artifacts = [...firstArtifacts, uploadArtifact, validationArtifact];
+    const finalUploadManifestPayload = {
+        ...uploadManifestPayload,
+        files: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+        artifacts: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+    };
+    writeJson(path.join(outputDir, 'upload-manifest.json'), finalUploadManifestPayload);
+    uploadArtifact = buildScanArtifact(outputDir, 'upload-manifest.json', 'upload-manifest', scanId);
+    artifacts = [...firstArtifacts, uploadArtifact, validationArtifact];
+    for (const artifact of artifacts) {
+        const validation = validateArtifactByType(artifact.absolutePath, artifact.artifactType, {
+            currentScanId: scanId,
+            scanStartedAt: startedAt,
+            fileManifest: fileManifest.files,
+            sourceManifestSha256: fileManifest.sha256,
+            expectedFilename: '.skip-sam.json',
+        });
+        if (!validation.valid)
+            throw new Error(`Artefato inválido (${artifact.filename}):\n${validation.errors.join('\n')}`);
     }
-    if (opts.verbose) {
-        console.log('\n' + chalk.dim('Briefing:'));
-        console.log(chalk.dim(briefing));
-        console.log('\n' + chalk.dim('Top violações WCAG:'));
-        for (const v of violations.slice(0, 8)) {
-            console.log(chalk.dim(`  [${v.severity}] ${v.title} — ${v.screen} (${v.selector})`));
-        }
+    let uploaded = false;
+    let confirmed = false;
+    console.log('[9/10] Enviando artefatos');
+    if (opts.send) {
+        const bundleManifestPayload = {
+            ...finalUploadManifestPayload,
+            artifacts: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+            files: artifacts.map(({ absolutePath, ...artifact }) => artifact),
+        };
+        const result = await uploadArtifactBundle(artifacts, opts.token, opts.url, bundleManifestPayload);
+        uploaded = true;
+        confirmed = result.confirmations.some((item) => item.filename === '.skip-sam.json' && item.persisted === true);
     }
-    if (opts.dryRun) {
-        console.log(chalk.bold.cyan('\n🏃 Modo dry-run: pulando envio.\n'));
-        console.log(`   Telas mapeadas:    ${chalk.bold(navigationMap.screens.length)}`);
-        console.log(`   Ações:             ${chalk.bold(totalActions)}`);
-        console.log(`   Arestas:           ${chalk.bold(navigationMap.navigationGraph.length)}`);
-        console.log(`   Fluxos guiados:    ${chalk.bold(guidedFlows.length)}`);
-        console.log(`   Score WCAG:        ${colorScore(score)} (${level})`);
-        console.log(`   Violações WCAG:    ${chalk.bold(String(total))} [${summary.critical} critical, ${summary.serious} serious, ${summary.moderate} moderate, ${summary.minor} minor]`);
-        console.log(`   Histórico:         ${chalk.bold(String(history.length))} scan(s)\n`);
-        return;
+    else {
+        console.log(chalk.dim('   --send não informado: upload pulado.'));
     }
-    const uploadSpinner = spinner('Enviando para o Skip Cloud...');
-    const scanId = await uploadReport(report, opts.token, opts.url);
-    uploadSpinner.succeed(`Scan enviado! ID: ${chalk.yellow(scanId)}`);
-    const status = await pollStatus(scanId, opts.token, opts.url);
-    printSummary({ scanId, entitiesCount: status.entitiesCount, baseUrl: opts.url, status: status.status });
-    if (status.status !== 'COMPLETED')
-        process.exitCode = 1;
+    console.log('[10/10] Confirmando a API');
+    if (opts.send && !confirmed)
+        throw new Error('Upload incompleto:\n`.skip-sam.json` não foi confirmado pela API.');
+    console.log('\nSAM');
+    console.log(`- Arquivo: .skip-sam.json`);
+    console.log(`- Caminho: ${samPath}`);
+    console.log(`- Criado no scan atual: sim`);
+    console.log(`- Scan ID: ${scanId}`);
+    console.log(`- Gerado em: ${sam.generatedAt}`);
+    console.log(`- Entidades: ${sam.entities.length}`);
+    console.log(`- Relacionamentos: ${sam.relationships.length}`);
+    console.log(`- Status: ${sam.status}`);
+    console.log(`- Validação: ${sam.validation.valid ? 'aprovada' : 'reprovada'}`);
+    console.log(`- SHA-256: ${samArtifact.sha256}`);
+    console.log(`- Enviado: ${uploaded ? 'sim' : 'não'}`);
+    console.log(`- Confirmado pela API: ${confirmed ? 'sim' : 'não'}`);
+    console.log(`- Score WCAG: ${colorScore(score)} (${level})`);
 }
-// ============ Entry point ============
 async function main() {
     const { command, opts } = parseCli();
-    if (command === 'send') {
+    if (command === 'send')
         await sendMode(opts);
-    }
-    else {
+    else
         await scanMode(opts);
-    }
 }
 main().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);